High · published September 9, 2025
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.
| Product | Versions | Fixed in |
|---|---|---|
| ivanti/neurons_for_secure_access | < 22.8 | 22.8 |
| ivanti/neurons_for_secure_access | all versions | — |
| ivanti/neurons_for_secure_access | all versions | — |
| ivanti/neurons_for_secure_access | all versions | — |
| ivanti/neurons_for_secure_access | all versions | — |
| ivanti/connect_secure | < 22.7 | 22.7 |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/connect_secure | all versions | — |
| ivanti/policy_secure | < 22.7 | 22.7 |
| ivanti/policy_secure | all versions | — |
| ivanti/policy_secure | all versions | — |
| ivanti/policy_secure | all versions | — |
| ivanti/policy_secure | all versions | — |
| ivanti/policy_secure | all versions | — |
| ivanti/policy_secure | all versions | — |
| ivanti/policy_secure | all versions | — |
| ivanti/zero_trust_access_gateway | all versions | — |